Distributed system, message processing method, nodes, client, and storage medium

ABSTRACT

The present disclosure discloses a distributed system and a message processing method. The distributed system includes a client and a plurality of nodes. The client includes processing circuitry that is configured to send a message including a digital signature of the client. The distributed system is in a first consensus mode for reaching a consensus on the message. The processing circuitry obtains results from a subset of the nodes that receive the message. The results have respective digital signatures of the subset of the nodes. After verifying the digital signatures of the subset of the nodes, the processing circuitry of the client determines, based on the results, whether one or more of the nodes in the distributed system is malfunctioned.

RELATED APPLICATION

This application is a continuation of International Application No.PCT/CN2018/080574, filed on Mar. 26, 2018, which claims priority toChinese Patent Application No. 201710203499.X, filed with the ChinesePatent Office on Mar. 30, 2017. The entire disclosures of the priorapplications are hereby incorporated by reference in their entirety.

FIELD OF THE TECHNOLOGY

The present disclosure relates to the communications technology.

BACKGROUND OF THE DISCLOSURE

A distributed system is a computing system that is commonly used atpresent, and is applied to various fields such as block chains anddistributed service frameworks (for example, ZooKeeper).

In a working process of the distributed system, nodes need to reach aconsensus on a to-be-processed message from a client, that is, all nodesor most nodes in the distributed system confirm a received message, andthen synchronously store/process the message.

For example, when the distributed system is applied to a private blockchain or a federal block chain, the nodes reach, based on a consensusalgorithm, a consensus on a transaction record committed by the client(that is, determine reliability of the transaction record), and storethe transaction record in block chains maintained by the nodes, therebyensuring consistency of the transaction record stored by the nodes.

A consensus algorithm used by a distributed system implemented in therelated technology focuses on consensus reaching efficiency or onensuring fault-tolerant performance in a consensus reaching process. Thefault-tolerant performance means that it is ensured that most nodes canstill reach a consensus when there is a faulty node or a malicious node.

For a consensus algorithm provided in the related technology forensuring the consensus reaching efficiency, it is difficult to ensureconsensus reliability due to that a faulty node and a malicious nodecannot be detected.

SUMMARY

Embodiments of the present disclosure provide a distributed system and amessage processing method. The distributed system includes a client anda plurality of nodes. The client includes processing circuitry that isconfigured to send a message including a digital signature of theclient. The distributed system is in a first consensus mode for reachinga consensus on the message. The processing circuitry obtains resultsfrom a subset of the nodes that receive the message. The results haverespective digital signatures of the subset of the nodes. Afterverifying the digital signatures of the subset of the nodes, theprocessing circuitry of the client determines, based on the results,whether one or more of the nodes in the distributed system ismalfunctioned.

In an embodiment, the distributed system further includes the nodes. Oneof the nodes is configured as a leader node and remaining nodes of thenodes are configured as follower nodes. In an example, the message fromthe client further includes first unique information. The subset is ofthe follower nodes. Each of the results includes second uniqueinformation. For each of the follower nodes, the processing circuitry ofthe client is further configured to determine whether the respectivefollower node is an erroneous node based on a determination that thesecond unique information in the result sent by the respective followernode is different from the first unique information in the message fromthe client. The processing circuitry of the client determines that therespective follower node is a faulty node when a result is not receivedfrom the respective follower node. In an example, the message from theclient includes a first sequence number. Each of the results includes asecond sequence number. For each of the follower nodes, the processingcircuitry of the client is further configured to determine that therespective follower node sends an inconsistent sequence number when thesecond sequence number is different from the first sequence number. Theprocessing circuitry of the client determines that the leader node is amalicious node when a number of the follower nodes sending theinconsistent sequence numbers exceeds a threshold.

In an embodiment, the processing circuitry of the client triggers thenodes in the distributed system to switch to a second consensus modewhen the client determines at least one of: the leader node is themalicious node, at least N of the follower nodes are the faulty nodes,and at least M of the follower nodes are the erroneous nodes. N and Mare positive integers.

In an embodiment, after receiving the trigger from the client to switchto the second consensus mode, the processing circuitry of each of thenodes sends a hash value in a message stored by the respective node anda digital signature of the respective node to other nodes in thedistributed system. The processing circuitry of the respective nodereceives hash values in messages from the other nodes. The processingcircuitry of the respective node determines whether the hash valuestored by the respective node is consistent with the hash values fromthe other nodes and sends a consistency confirmation to the client whenthe hash value stored by the respective node is determined to beconsistent with the hash values from the other nodes.

In an embodiment, the processing circuitry of the client determineswhether the consistency confirmation from each of the nodes is received.When the client does not receive the consistency confirmation from atleast one of the nodes within a pre-determined time, the processingcircuitry of the client notifies the nodes to switch to the secondconsensus mode. When the client receives the consistency confirmationfrom each of the nodes within the pre-determined time, the processingcircuitry of the client notifies the nodes to switch to the firstconsensus mode.

In an embodiment, after receiving the trigger to switch to the secondconsensus mode, the processing circuitry of each of the nodes sends ahash value in a message stored by the respective node and a digitalsignature of the respective node to other nodes in the distributedsystem. The processing circuitry of the respective node receives anotherhash value in a message from one of the other nodes and determineswhether the hash value stored by the node is consistent with the otherhash value from the one of the other nodes. When the hash value of therespective node is determined to be consistent with the other hashvalue, the processing circuitry of the respective node sends a dataconfirmation to the one of the other nodes. The data confirmationincludes a digital signature of the respective node and indicates thatthe message stored by the respective node is consistent with the messagefrom the one of the other nodes. When the respective node receives thedata confirmation from each of the other nodes, the processing circuitryof the respective node sends a data confirmation to the client.

In an embodiment, the processing circuitry of the client determineswhether the message stored in the respective node is consistent with themessages stored in the other nodes based on the respective dataconfirmations. When each of the data confirmations is received within apre-determined time, the processing circuitry of the client notifies thenodes to switch back to the first consensus mode and terminatesswitching to the second consensus mode. When at least one of the dataconfirmations is not received within the pre-determined time, theprocessing circuitry of the client notifies the nodes to switch to thesecond consensus mode.

In an embodiment, the processing circuitry of the leader node switchesthe nodes to the first consensus mode when a number of times that thenodes reach a consensus on the received message from the client in thesecond consensus mode exceeds a first consensus threshold of the leadernode.

In an embodiment, the processing circuitry of one of the follower nodesis configured to count a number of times that a consensus is reached onthe received message when receiving a notification to switch to thefirst consensus mode and send a switch acknowledgement to the leadernode when the counted number of times exceeds a second consensusthreshold of the one of the follower nodes.

Aspects of the disclosure also provide a non-transitorycomputer-readable storage medium storing instructions which whenexecuted by one or more computers cause the one or more computers toperform the message processing method.

The embodiments of the present disclosure have such beneficial effects:

(1) Reliability of communication in the distributed system is ensured byusing a digital signature: A digital signature is used for both partiesin communication, that is, a digital signature of a message is carriedwhen the message is sent, and reliability of the received message isensured by verifying the digital signature.

(2) The follower nodes directly return the results to the client whenreceiving the message sent by the leader node, and add information suchas a uniqueness field, a sequence number of the message, and a digitalsignature to the result, so that the client can directly determineconsensus reaching between the follower nodes according to the resultsreturned by the follower nodes, thereby efficiently detecting theabnormal node.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is an optional schematic structural diagram of a distributedsystem 100 applied to a block chain system according to an embodiment ofthe present disclosure.

FIG. 2 is an optional schematic diagram of a block structure accordingto an embodiment of the present disclosure.

FIG. 3A is an optional schematic structural diagram of software/hardwareof a node 200 according to an embodiment of the present disclosure.

FIG. 3B is an optional schematic structural diagram of software andhardware of a client 300 according to an embodiment of the presentdisclosure.

FIG. 4 is an optional schematic diagram of performing a voting operationby nodes in a first consensus mode to determine a leader node andfollower nodes according to an embodiment of the present disclosure.

FIG. 5 is an optional schematic flowchart of reaching a consensus bynodes in a distributed system in a first consensus mode and detecting afaulty node and a malicious node according to an embodiment of thepresent disclosure.

FIG. 6 is an optional schematic flowchart of switching between a firstconsensus mode and a second consensus mode by a distributed systemaccording to an embodiment of the present disclosure.

FIG. 7 is an optional schematic flowchart of switching between a firstconsensus mode and a second consensus mode by a distributed systemaccording to an embodiment of the present disclosure.

FIG. 8 is an optional schematic flowchart of reaching a consensus by ablock chain system by using a RAFT algorithm according to an embodimentof the present disclosure.

FIG. 9 is an optional schematic flowchart of reaching a consensus by ablock chain system by using a PBFT algorithm according to an embodimentof the present disclosure.

FIG. 10 is a diagram of an operating status of implementing an adaptiveconsensus algorithm according to an embodiment of the presentdisclosure.

FIG. 11 is a schematic diagram of implementation of a T-RAFT algorithmconsensus according to an embodiment of the present disclosure.

FIG. 12 is an optional schematic flowchart of switching back to a T-RAFTalgorithm at a preparation stage of switching to a PBFT algorithmaccording to an embodiment of the present disclosure.

FIG. 13 is an optional schematic flowchart of switching from a T-RAFTalgorithm consensus to a PBFT algorithm consensus by a block chainsystem according to an embodiment of the present disclosure.

FIG. 14 is an optional schematic flowchart of switching from a PBFTalgorithm consensus mode to a T-RAFT algorithm consensus mode by a blockchain system according to an embodiment of the present disclosure.

FIG. 15 is an optional schematic diagram of a scenario in which adistributed system is applied to a federal chain system according to anembodiment of the present disclosure.

DESCRIPTION OF EMBODIMENTS

The present disclosure is further described in detail below withreference to the accompanying drawings and embodiments. The embodimentsprovided herein are merely used for explaining the present disclosureinstead of limiting the present disclosure. In addition, technicalsolutions set forth in the embodiments of the present disclosure may beimplemented in any combination without conflict.

(1) A distributed system is a system including a plurality of nodes anda client that are connected through network communication. Content of amessage used for the network communication varies according to actualservice scenarios. For example, the message may be a transaction recordor an instruction executed by a state machine of a node.

(2) Consensus: In the distributed system, a node (or a node sending amessage) verifies correctness of another message sent by another node(that is, another node in the distributed system other than the nodesending the message), sends, if successfully verifying the correctness,a confirmation to the node sending the message, and persistently storesthe message to support subsequent query.

For example, when the distributed system is implemented as a block chainsystem, a node verifies validness of a new block (including a newlygenerated transaction record) committed by another node, sends, ifsuccessfully verifying the validness, a confirmation to the node sendingthe new block, and adds the new block to a tail portion of a block chainstored by the corresponding node, to complete a consensus on thetransaction record in the block chain.

(3) A consensus mode is also referred to as a consensus algorithm, andis an algorithm used for ensuring that nodes in the distributed systemreach a consensus. The consensus mode may include the following types:

First consensus mode is a consensus mode in which relatively highconsensus efficiency can be achieved, and a node fault or a Byzantineproblem (a case in which one party sends a message to another party andthe another party does not receive the message or receives wronginformation) can be detected, but the Byzantine problem cannot beresolved. For example, algorithms implementing the first consensus modeinclude a Paxos algorithm and a recursive algorithm for fault tolerance(RAFT).

A second consensus mode is a consensus mode used for resolving theByzantine problem. Algorithms implementing the second consensus modeinclude a Byzantine fault tolerance (BFT) algorithm, a practicalByzantine fault tolerance (PBFT) algorithm, a Byzantine faulttolerance-recursive algorithm for fault tolerance (BFT-RAFT), aBFT-Paxos algorithm, and the like.

(4) Consensus mode switching is also referred to as consensus modeadaptation. For a consensus algorithm used in a distributed network,when a network environment is desirable, an algorithm that has highconsensus efficiency and that can be used for detecting an abnormal node(for example, a node having a Byzantine problem) is automatically used,to implement the first consensus mode; and when a malicious node isfound or a node is erroneous, the consensus algorithm is automaticallyswitched to an algorithm supporting Byzantine fault tolerance, toimplement the second consensus mode.

A distributed system implementing the embodiments of the presentdisclosure includes a client and a plurality of nodes (computing devicesin any form in an access network, for example, a server and a userterminal) that are connected through network communication. Functions ofthe client and the node are described below.

The node is configured to determine, through a voting operation when anew consensus cycle in a first consensus mode starts, whether the nodeis in a leader node state or a follower node state.

The node is configured to verify, when the node is in the leader nodestate, a digital signature of a message sent by the client, and send themessage to follower nodes.

The node is configured to: receive, when the node is in the leader nodestate, reception acknowledgement notifications of more than apredetermined quantity of follower nodes, persistently store the messageafter verifying digital signatures of the reception acknowledgementnotifications, and send a message storage notification to the followernodes.

The node is further configured to: return, when the node is in thefollower node state, a result to the client when receiving a messagesent by a leader node, verify a digital signature of the messagereceived from the leader node, and send a reception acknowledgementnotification to the leader node.

The node is configured to verify, when the node is in the follower nodestate, a digital signature of the message storage notification receivedfrom the leader node, and persistently store the message received fromthe leader node.

The client is configured to determine an abnormal node in thedistributed system according to the result returned by the follower nodewhen the follower node receives the message.

In an embodiment, the client is further configured to: compare auniqueness field (or unique information) included in the received resultwith a uniqueness field of the sent message after verifying a digitalsignature of the received result, determine that a follower nodecorresponding to an inconsistent uniqueness field is an erroneous node,and determine that a follower node not returning a result is a faultynode.

In an embodiment, the client is further configured to compare a sequencenumber carried in the received result with a sequence number of the sentmessage, and determine, when a quantity of follower nodes sendinginconsistent sequence numbers exceeds an inconsistency quantitythreshold, that the leader node is a malicious node.

In an embodiment, the client is further configured to determine that theleader node is a malicious node; or trigger, when determining there is afaulty node in the follower nodes, the nodes in the distributed systemto switch to a second consensus mode.

In an embodiment, the node is further configured to compare, at apreparation stage of switching to the second consensus mode, a hashvalue of the message persistently stored by the node with a hash valueof a message persistently stored by a node in the distributed system,and send a consistency confirmation to the client when determining thatthe hash values are consistent. The consistency confirmation carries adigital signature of the corresponding node.

The client is further configured to instruct, when receiving consistencyconfirmations of all the nodes within a pre-determined time, the nodesin the distributed system to return to the first consensus mode; orinstruct, when not receiving consistency confirmations of all the nodeswithin a pre-determined time, the nodes in the distributed system tocontinue switching to the second consensus mode.

In an embodiment, the node is further configured to compare, at apreparation stage of switching to the second consensus mode, a hashvalue of the message persistently stored by the node with a hash valueof a message persistently stored by a node in the distributed system,and send a data confirmation to a sending node of the message whendetermining that the hash values are consistent. The data confirmationcarries a digital signature of the corresponding node.

The client is further configured to trigger, when nodes reaching aconsensus do not receive, within a pre-determined time, a dataconfirmation from a node not reaching the consensus or the nodes in thedistributed system do not receive a data confirmation in apre-determined time, the nodes in the distributed system to continueswitching to the second consensus mode.

In an embodiment, the node is further configured to switch to the firstconsensus mode with the follower nodes when the node is in the leadernode state and when a quantity of times counted in the second consensusmode exceeds a consensus quantity-of-times threshold of the leader node.The counted quantity of times is a count of forming consensuses with thefollower nodes on the received message.

In an embodiment, the node is further configured to send, to thefollower nodes when the node is in the leader node state and when thecounted quantity of times exceeds the consensus quantity-of-timesthreshold of the leader node, a notification of switching to the firstconsensus mode, and start to synchronously switch to the first consensusmode with the follower nodes when receiving switch acknowledgements sentby all the follower nodes.

In an embodiment, the node is further configured to receive, when thenode is in the follower node state, a notification of switching to thefirst consensus mode, and send a switch acknowledgement to the leadernode when a counted quantity of times that a consensus is reached on thereceived message exceeds a consensus quantity-of-times threshold of thefollower node.

In an embodiment, the node is further configured to perform the votingoperation again when not receiving heartbeat information of the leadernode or when the leader node is a malicious node, to determine whetherthe node is in the leader node state or the follower node state.

In an embodiment, the node is further configured to: send a votingrequest to the nodes in the distributed system when the new consensuscycle starts and heartbeat information of no node is received, convertinto the leader node state when receiving voting acknowledgementsreturned by a pre-determined quantity of nodes, and periodically sendheartbeat information to the nodes in the distributed system.

The voting acknowledgement is sent by the nodes in the distributedsystem, and a digital signature carried in the voting request isverified before the voting acknowledgement is sent.

In an embodiment, the node is further configured to convert into thefollower node state when the new consensus cycle starts and heartbeatinformation sent by a node in the distributed system is received.

Descriptions are provided below by using an example in which thedistributed system is implemented as a block chain system. FIG. 1 is anoptional schematic structural diagram of a distributed system 100implemented as a block chain system according to an embodiment of thepresent disclosure. The distributed system 100 includes a plurality ofnodes 200 (computing devices in any form in an access network, forexample, a server and a user terminal), and further includes a client300. A peer-to-peer (P2P) network is formed between the nodes 200. TheP2P protocol is an application-layer protocol running over theTransmission Control Protocol (TCP).

Referring to functions of the node 200 in the block chain system shownin FIG. 1, the functions include the following:

(1) Routing: which is a basic function of the node, and is used forsupporting communication between nodes.

In addition to the routing function, the node 200 may further have thefollowing functions:

(2) Application: which is deployed in a block chain, and is used forimplementing a particular service according to an actual servicerequirement, recording data related to function implementation to formrecorded data, adding a digital signature to the recorded data toindicate a source of task data, and sending the recorded data to anothernode in the block chain system (that is, any node receiving the recordeddata in the block chain system), so that the another node adds therecorded data to a temporary block when verifying a source and integrityof the recorded data.

For example, services implemented by the application include:

(2.1) Wallet: used for providing a transaction function with electronicmoney, including transaction initiation (where to be specific, atransaction record of a current transaction is sent to another node inthe block chain system, and the another node stores, after successfullyverifying the transaction record, recorded data of the transaction to atemporary block in a block chain in response to admitting that thetransaction is valid). Certainly, the wallet further supports queryingfor remaining electronic money in an electronic money address.

(2.2) Shared account book: used for providing functions of operationssuch as storage, query, and modification of account data. Recorded dataof the operations on the account data is sent to another node in theblock chain system. The another node stores, after verifying that theaccount data is valid, the recorded data to a temporary block inresponse to admitting that the account data is valid, and may furthersend an acknowledgement to a node initiating the operations.

(2.3) Intelligent contract: which is a computerized protocol, can beused for executing conditions of a contract, and is implemented by usingcode that is deployed in the shared account book and that is executedwhen a condition is satisfied. The code is used for completing,according to an actual service requirement, an automated transaction,for example, searching for a delivery status of goods purchased by apurchaser, and transferring electronic money of the purchaser to anaddress of a merchant after the purchaser signs for the goods.Certainly, the intelligent contract is not limited only to a contractused for executing a transaction, and may further be a contract used forprocessing received information.

(3) Block chain: including a series of blocks that are consecutive in achronological order of generation. Once a new block is added to theblock chain, the new block is no longer removed. The block recordsrecorded data committed by the node in the block chain system.

In an example, FIG. 2 is an optional schematic diagram of a blockstructure according to an embodiment of the present disclosure. Eachblock includes a hash value of a transaction record stored in thecurrent block (a hash value of the current block) and a hash value of aprevious block. Blocks are connected according to hash values to form ablock chain. In addition, the block may further include information suchas a timestamp indicating a block generation time.

Composition of the distributed system implementing the embodiments ofthe present disclosure can flexibly vary. For example, in thedistributed system, any machine such as a server or a terminal can beadded to the distributed system to become a node. In terms of hardware,for example, FIG. 3A is an optional schematic structural diagram ofsoftware/hardware of a node 200 according to an embodiment of thepresent disclosure. The node 200 includes a hardware layer, a driverlayer, an operating system layer, and an application layer. A structureof the node 200 shown in FIG. 3A is merely an example and does notconstitute a limitation on the structure of the node 200. For example,the node 200 may be provided with more components than those shown inFIG. 3A according to an implementation requirement, or some componentsmay be omitted.

The hardware layer of the node 200 includes a processor 210, aninput/output interface 240, a storage medium 230, and a networkinterface 220. The components may be connected through a system bus forcommunication.

The processor 210 may be implemented by using a central processing unit(CPU), a microcontroller unit (MCU), an application-specific integratedcircuit (ASIC), or a field programmable gate array (FPGA).

The input/output interface 240 may be implemented by using aninput/output device such as a display screen, a touchscreen, or aspeaker.

The storage medium 230 may be implemented by using a non-volatilestorage medium such as a flash, a hard disk, or an optical disc, or maybe implemented by using a volatile storage medium such as a double datarate (DDR) dynamic cache. The storage medium 230 stores executableinstructions used for performing a message processing method.

The network interface 220 provides external data, for example, aremotely set access capability of the storage medium 230, to theprocessor 210. For example, the network interface 220 can implementcommunication based on communication standards such as Code DivisionMultiple Access (CDMA) and Wideband Code Division Multiple Access(WCDMA) and evolved standards thereof.

The driver layer includes middleware 250 used by an operating system 260for identifying the hardware layer and communicating with each componentof the hardware layer, and for example, may be a set of drivers for eachcomponent of the hardware layer.

The operating system 260 is configured to provide a user-orientedgraphics interface, and display various intermediate results and finalresults of various block-chain-based application processing.

The application layer includes a consensus mechanism 270 (configured toadaptively switch between a first consensus mode and a second consensusmode) configured to implement consensus reaching between nodes andfunctions, for example, an electronic money wallet 280 and anintelligent contract 290, that are implemented by the nodes based on thedistributed system. In an example, the application layer is configuredto be operable in the first consensus mode and the second consensusmode.

Using the application layer as an example, referring to FIG. 3A, theconsensus mechanism 270 of the application layer of the node 200provided in FIG. 3A includes: a voting unit 2701, a leader node unit2702, and a follower node unit 2703.

The voting unit 2701 is configured to enable the node 200 and othernodes in the distributed system to perform a voting operation when a newconsensus cycle in the first consensus mode starts, to determine whetherthe node 200 is in a leader node state or a follower node state.

The leader node unit 2702 is configured to: receive a message of aclient when the node 200 is in the leader node state; send the messageto follower nodes after verifying a digital signature of the message;when receiving reception acknowledgement notifications of more than apredetermined quantity of follower nodes, persistently store the messageafter verifying digital signatures of the reception acknowledgementmessages; and send a message storage notification to the follower nodes.

Results returned by the follower nodes when the follower nodes receivethe message are used by the client for determining an abnormal node inthe distributed system.

The follower node unit 2703 is configured to: when the node 200 is inthe follower node state, persistently store the received message afterverifying a digital signature of the received message storagenotification. The message is used by the client for determining theabnormal node.

In an embodiment, the follower node unit 2703 is configured to performthe following operations when the node 200 is in the follower nodestate: receiving the message sent by a leader node, returning a resultto the client, sending a reception acknowledgement notification to theleader node after verifying a digital signature of the received message,and persistently storing the received message after verifying thedigital signature of the received message storage notification.

In an embodiment, when the node 200 is in the follower node state, theresult returned by the follower node to the client carries the followinginformation: a uniqueness field of the message and a digital signatureof the follower node. The result is used by the client for: verifyingthe carried digital signature, compare the uniqueness field included inthe result with a uniqueness field of the sent message, determining afollower node corresponding to an inconsistent uniqueness field is anerroneous node, and determining a follower node not returning acorresponding result is a faulty node.

In an embodiment, when the node 200 is in the follower node state, theresult returned by the follower node carries a sequence number of themessage received by the follower node. The sequence number carried inthe result is used by the client for comparing the sequence numbercarried in the received result and a sequence number of the sentmessage, and determining, when a quantity of follower nodes sendinginconsistent sequence numbers exceeds an inconsistency quantitythreshold (or a threshold), that the leader node is a malicious node.

In an embodiment, the consensus mechanism 270 further includes aswitching unit 2704, configured to switch to the second consensus modein response to trigger of the client when the client determines that theleader node is a malicious node or determines that there is a faultynode in the follower nodes.

In an embodiment, the switching unit 2704 is configured to switch to thesecond consensus mode in response to a trigger of the client when theclient determines that the leader node and the follower nodes satisfy atleast one of: the leader node is a malicious node, at least N of thefollower nodes are faulty nodes, and at least M of the follower nodesare erroneous nodes where N and M are positive integers.

In an embodiment, the switching unit 2704 is further configured toperform the following operations when the node 200 is at a preparationstage of switching to the second consensus mode:

comparing a hash value of the message persistently stored by the node200 with a hash value of a message persistently stored by a node in thedistributed system (that is, a node in the distributed system other thanthe node 200), sending a consistency confirmation to the client whendetermining that the hash values are consistent, where the consistencyconfirmation carries a digital signature of the corresponding node thatis verified by the client when the client receives the consistencyconfirmation; and

switching to the first consensus mode in response to a notification ofthe client when the client receives consistency confirmations of all thenodes within a pre-determined time; or

continuing switching to the second consensus mode in response to anotification of the client when the client does not receive consistencyconfirmations of all the nodes within a pre-determined time.

In an embodiment, the switching unit 2704 is further configured toperform the following operations when the node 200 is at a preparationstage of switching to the second consensus mode:

comparing a hash value of the message persistently stored by the nodewith a hash value of a message persistently stored by a node in thedistributed system (that is, a node in the distributed system other thanthe node 200), and sending a data confirmation to a sending node of themessage when determining that the hash values are consistent, where thedata confirmation carries a digital signature of the corresponding node.

The data confirmation is used by the client for triggering, when nodesreaching a consensus do not receive, within a pre-determined time, adata confirmation of a node not reaching the consensus or the nodes inthe distributed system do not receive, within a pre-determined time, adata confirmation sent by another node, the nodes in the distributedsystem to continue switching to the second consensus mode.

In an embodiment, the leader node unit 2702 is further configured toswitch to the first consensus mode with the follower nodes when the node200 is in the leader node state and a quantity of times that a consensusis reached with the follower nodes on the received message that iscounted in the second consensus mode exceeds a consensusquantity-of-times threshold of the leader node.

In an embodiment, the leader node unit 2702 is further configured tosend, to the follower nodes when the quantity of times counted in thesecond consensus mode exceeds the consensus quantity-of-times thresholdof the leader node, a notification of switching to the first consensusmode, and start to synchronously switch to the first consensus mode withthe follower nodes when switch acknowledgements sent by all the followernodes are received. The counted quantity of times is a count of formingconsensuses with the follower nodes on the received message.

In an embodiment, the follower node unit 2703 is further configured toperform the following operations when the node is in the follower nodestate: counting, when receiving a notification of switching to the firstconsensus mode, a quantity of times that a consensus is reached on thereceived message, and sending a switch acknowledgement to the leadernode when the counted quantity of times exceeds a consensusquantity-of-times threshold of the follower node.

In an embodiment, the voting unit 2701 is further configured to performa voting operation with the nodes in the distributed system (that is,the nodes in the distributed system other than the node 200) whenheartbeat information of the leader node is not received or the leadernode is a malicious node, to determine whether the node 200 is in theleader node state or the follower node state.

In an embodiment, the voting unit 2701 is further configured to send avoting request to the nodes in the distributed system when the newconsensus cycle starts and heartbeat information sent by a node in thedistributed system is not received, where the voting request carries adigital signature of the node; switch to the leader node state whenvoting acknowledgements returned by a pre-determined quantity of nodesare received, and periodically send heartbeat information to the nodesin the distributed system to remain in the leader node state. The votingacknowledgements are sent by the nodes in the distributed system afterthe nodes verify the digital signature carried in the voting request.

The voting unit 2701 is further configured to switch to the followernode state when the new consensus cycle starts and heartbeat informationsent by a node in the distributed system is received.

In the distributed system, the client may be a combination of hardwareand a software environment deployed on the hardware. Based on this, theclient may also be referred to as a client device, configured toimplement functions such as mining (for example, Bitcoin mining), nodemanagement, and deployment of an intelligent contract.

FIG. 3B is an optional schematic structural diagram of software/hardwareof a client according to an embodiment of the present disclosure. Aclient 300 includes a hardware layer, a driver later, an operatingsystem layer, and an application layer. A structure of the client 300shown in FIG. 3B is merely an example and does not constitute alimitation on the structure of the client 300. For example, the client300 may be provided with more components than those shown in FIG. 3Baccording to an implementation requirement, or some components may beomitted according to an implementation requirement.

The hardware layer of the client 300 includes a processor 310, aninput/output interface 340, a storage medium 330, and a networkinterface 320. The components may be connected through a system bus forcommunication.

The processor 310 may be implemented by using a CPU, an MCU, an ASIC, oran FPGA.

The input/output interface 340 may be implemented by using aninput/output device such as a display screen, a touchscreen, or aspeaker.

The storage medium 330 may be implemented by using a non-volatilestorage medium such as a flash, a hard disk, or an optical disc, or maybe implemented by using a DDR. The storage medium 330 stores executableinstructions used for performing the foregoing communication statusprocessing method (or the message processing method described above).

The network interface 320 provides external data, for example, aremotely set access capability of the storage medium 330, to theprocessor 310. For example, the network interface 320 can implementcommunication based on communication standards such as CDMA and WCDMAand evolved standards thereof.

The driver layer includes middleware 350 used by an operating system 360for identifying the hardware layer and communicating with each componentof the hardware layer, and for example, may be a set of drivers for eachcomponent of the hardware layer.

The operating system 360 is configured to provide a user-orientedgraphics interface, and display various intermediate results and finalresults of various block-chain-based application processing.

The application layer is configured to: send a message to nodes in adistributed system, so that the nodes reach a consensus on the messageto persistently store the message; detect an abnormal node in thedistributed system; and trigger the nodes to switch a consensus mode.

Using the application layer as an example, FIG. 3B provides a functionalstructure of the application layer of the client 300. The functionalstructure includes a management node 380, a deployed intelligentcontract 390, and a consensus 370.

In an example, the consensus 370 includes an communications unit 3701and a detection unit 3702.

The communications unit 3701 is configured to send a message to a leadernode in the nodes of the distributed system. The message carries adigital signature of a client.

The digital signature is verified by the leader node. A digitalsignature of the leader node is added to the received message to sendthe message to follower nodes in the distributed system.

The communications unit 3701 is configured to receive a result returnedby the follower node when the follower node receives the message.

The detection unit 3702 is configured to determine an abnormal node inthe distributed system according to the result returned by the followernode when the follower node receives the message.

In an embodiment, the detection unit 3702 is further configured to:compare a uniqueness field included in the received result with auniqueness field of the sent message after verifying a digital signatureof the received result, determine that a follower node corresponding toan inconsistent uniqueness field is an erroneous node, and determinethat a follower node not returning a corresponding result is a faultynode.

In an embodiment, the detection unit 3702 is further configured tocompare a sequence number carried in the received result with a sequencenumber of the sent message, and determine, when a quantity of followernodes sending inconsistent sequence numbers exceeds an inconsistencyquantity threshold, that the leader node is a malicious node.

In an embodiment, the consensus 370 further includes a switching unit3703, configured to trigger, when it is determined that the leader nodeis a malicious node or there is a faulty node in the follower nodes, thenodes in the distributed system to switch to a second consensus mode.

In an embodiment, the switching unit 3703 is further configured toinstruct, when receiving consistency confirmations of all the nodeswithin a pre-determined time, all the nodes to return to a firstconsensus mode; or instruct, when not receiving consistencyconfirmations of all the nodes within a pre-determined time, all thenodes to continue switching to the second consensus mode.

The consistency confirmation carries a digital signature of the node andis sent when the node is at a preparation stage of switching to thesecond consensus mode. The node determines, before sending, that a hashvalue of the message persistently stored by the node is consistent witha hash value of a message persistently stored by a node in thedistributed system.

In an embodiment, the switching unit 3703 is further configured totrigger, when nodes reaching a consensus do not receive, within apre-determined time, a data confirmation from a node not reaching theconsensus or the nodes in the distributed system do not receive, withina pre-determined time, a data confirmation sent by another node, thenodes in the distributed system to continue switching to the secondconsensus mode.

The data confirmation carries a digital signature of a correspondingnode and is sent by the node 200 at a preparation stage of switching tothe second consensus mode. The node 200, determines, before sending,that a hash value of the message persistently stored by the node 200 isconsistent with a hash value of a message persistently stored by a nodein the distributed system (that is, a node in the distributed systemother than the node 200).

For the distributed system provided in this embodiment of the presentdisclosure, the nodes reach a consensus on the message from the clientin the first consensus mode. The first consensus mode can ensureconsensus reaching efficiency of the nodes. Certainly, that the nodes inthe distributed system reach a consensus on the message from the clientin the second consensus mode by default is not excluded from thisembodiment of the present disclosure.

An implementation of reaching the consensus in the first consensus modeis described. FIG. 5 is an optional schematic flowchart of reaching aconsensus by nodes in a distributed system in a first consensus mode anddetecting a faulty node and a malicious node according to an embodimentof the present disclosure. Descriptions are provided with reference tostep 101 to step 108.

Step 101: A plurality of nodes in the distributed system performs avoting operation when a new consensus cycle in a first consensus modestarts, to determine whether the nodes are in a leader node state or afollower node state.

In an embodiment, the nodes in the distributed system include threetypes (also referred to as states): a competitive node, a leader node,and a follower node. Each node in the distributed system enables atimer. When the new consensus cycle used for reaching a consensusreaches, each node is a competitive node. Each competitive node attemptsto convert into a leader node (where for example one distributed systemhas only one valid leader node) through the voting operation, and acompetitive node not becoming the leader node converts into a followernode.

When the new consensus cycle starts, each competitive node detectswhether heartbeat information sent by another node is received. If noheartbeat information is received, it indicates that no leader node isgenerated within the current consensus cycle, and the competitive nodesends a voting request to other nodes. The voting request carries adigital signature of the sending node. After successfully verifying thedigital signature in the voting request, a receiving node determinesreliability of the voting request, that is, sends a votingacknowledgement to the sending node. When a node receives votingacknowledgements from a sufficient quantity (where a pre-determinedquantity may be half a quantity of the nodes) of other nodes, the nodeconverts into the leader node, and periodically sends heartbeatinformation to the other nodes. A competitive node receiving theheartbeat information converts into the follower node. When no nodereceives the sufficient quantity of voting acknowledgements within aconsensus cycle, a new consensus cycle starts to continue the votingoperation until the leader node and the follower nodes are determined.

Using a RAFT algorithm as an example of the first consensus mode, FIG. 4is an optional schematic diagram of performing a voting operation bynodes in a first consensus mode to determine a leader node and followernodes according to an embodiment of the present disclosure.

In a distributed system, at any time point, any node is in one of thefollowing three states: a leader node, a follower node, and acompetitive node. In most time of normal running of the distributedsystem, the distributed system includes one leader node, and other nodesare all follower nodes. The leader node receives a message of a client.

Working time of the distributed system is divided into consecutiveconsensus cycles which are also referred to as terms herein. Each termmay be of any duration, and the terms are numbered by using consecutiveintegers. The leader node is first voted in each term. At a votingstage, a plurality of competitive nodes contends for the leader node.Once a node becomes the leader node, other competitive nodes convertinto follower nodes. In an embodiment, the node becoming the leader nodeserves as the leader node all the time within the term. If the leadernode is faulty, the other nodes perform a voting operation in a newterm.

There cannot be a plurality of leader nodes within any term (unless amalicious node disguises as the leader node). Each node maintains acount of a current term, and communication between nodes each timeincludes the count of the term. When each node detects that a term countmaintained by the node is less than a term count maintained by anothernode, the node updates the term count of the node to be a maximum valuethat is detected.

When a leader node and a competitive node in a previous consensus cyclefind out that their term counts are less than a term count of anothernode, the leader node and the competitive node immediately convert intofollower nodes, to ensure that there is only one leader node within eachterm, for example.

The leader node voting operation is triggered by using a heartbeatmechanism in the RAFT algorithm. When the distributed system is started,all nodes are initialized into a follower node state to set a term to 0,and enable a timer. After the timer expires, a follower node convertsinto a competitive node. Once the follower node converts into thecompetitive node, the follower node performs the following operations:

Step 1011: Increase a term count of the node.

Step 1012: Enable a new timer.

Step 1013: Send a voting request (Request Vote) Remote Procedure Call(RPC) Protocol message to other nodes, and wait for the other nodes toreply a voting acknowledgement.

If receiving voting acknowledgements from most nodes before the timerexpires, the node converts into a leader node. If an Append Entriesheartbeat RPC message whose appended content is null and that is sent byanother node is received, it indicates that the another node has beenselected as the leader node, and the node converts into a follower node.If none of the foregoing two types of information is received when thetimer expires, a new voting operation is performed.

After the node receives votes from most nodes to become the leader node,the node immediately sends an Append Entries heartbeat RPC message toall nodes. After receiving the Append Entries heartbeat RPC message, thecompetitive node converts into a follower node, and the voting operationends.

Step 102: The client adds a digital signature to a message, and sendsthe message carrying the digital signature to a leader node.

The client encrypts a digest of the message by using a private key ofthe client (where any digest algorithm may be used to extract the digestfrom the message in this embodiment of the present disclosure), to formthe digital signature.

Step 103: After successfully verifying the digital signature of themessage, the leader node adds a digital signature of the leader node tothe message, and sends the message to follower nodes.

The leader node decrypts the digital signature by using a public key toobtain the digest, and compares the digest with a digest obtained byusing a digest algorithm (which is consistent with the digest algorithmused by the client). If the digests are consistent, it indicates that asource of the message is reliable. The leader node encrypts the digestof the message by using a private key of the leader node to form thedigital signature of the leader node, and adds the digital signature ofthe leader node to the message to send the message to each followernode. A digital signature of the client may be or may not be carried inthe message. If comparing that the digests are inconsistent, the leadernode may discard the message and requests the client to retransmit themessage.

Step 104: After receiving the message sent by the leader node, thefollower node verifies the digital signature of the received message,sends a reception acknowledgement notification to the leader node afterthe verification succeeds, and sends a result to the client.

The follower node decrypts the digital signature of the received messageby using the public key to obtain the digest, and compares the digestwith a digest obtained by using a digest algorithm (which is consistentwith the digest algorithm used by the leader node). If the digests areconsistent, it indicates that a source of the message is reliable. Thefollower node encrypts a digest of the reception acknowledgementnotification by using a private key of the follower node to form adigital signature of the follower node, and returns the receptionacknowledgement notification to the leader node.

The result sent by the follower node to the client includes two cases:

(1) Within a current consensus cycle, if the follower node receives themessage sent by the leader node for the first time, the result sent tothe client includes: a sequence number of the received message; auniqueness field of the message (a field in the message, which can bedistinguished from a field of another message); and a digital signatureof the follower node for the result. The digital signature is obtainedby encrypting a digest of the result by using the private key of thefollower node.

(2) Within a current consensus cycle, if the follower node receives themessage sent by the leader node not for the first time, the result sentto the client includes a uniqueness field of the message (a field in themessage, which can be distinguished from a field of another message) anda digital signature of the follower node for the result. The digitalsignature is obtained by encrypting a digest of the result by using theprivate key of the follower node.

Step 105: The leader node verifies a digital signature carried in thereceived reception acknowledgement notification, persistently stores themessage after continuously receiving reception acknowledgementnotifications sent by a pre-determined quantity of follower nodes, andsends a message storage notification to the follower nodes.

The message storage notification carries a digital signature of theleader node for the message storage notification, and the digitalsignature is obtained by encrypting a digest of the message storagenotification by using the private key of the leader node.

Persistent storage means that the leader node stores the message in anon-volatile manner. For example, in a block chain system, a node (theleader node) receiving a transaction record committed by the clientstores the transaction record in a new block of a block chain.

Step 106: The follower node receives the message storage notification,persistently stores the message locally after successfully verifying acarried digital signature, and sends a message storage acknowledgementcarrying a digital signature to the leader node.

The follower node decrypts the digital signature of the received messagestorage notification by using the public key to obtain the digest, andcompares the digest with a digest obtained by using a digest algorithm(which is consistent with a digest algorithm used by the leader node).If the digests are consistent, it indicates that a source of the messagestorage notification is reliable. The follower node encrypts a digest ofthe message storage acknowledgement by using the private key of thefollower node to form the digital signature of the follower node, andreturns the message storage acknowledgement carrying the digitalsignature to the leader node.

Step 107: The leader node verifies a digital signature of the receivedmessage storage acknowledgement, and sends the message storageacknowledgement to the client if receiving message storageacknowledgements of follower nodes whose quantity exceeds half thequantity of the nodes and successfully verifying digital signatures.

The message storage acknowledgement sent by the leader node to theclient carries the digital signature of the leader node that is used bythe client for verifying reliability of a source of the message storageacknowledgement.

Step 108: The client detects an abnormal node according to the resultreturned by the follower node when the follower node receives themessage: determine whether the leader node is a malicious node, anddetermine whether there is a faulty node in the follower nodes.

In an embodiment, after successfully verifying the digital signature ofthe result returned by each follower node (where the result is sent byeach follower node after the follower node receives the message sent bythe leader node), the client compares a uniqueness field included in thereceived result with a uniqueness field of the sent message; determines,if the uniqueness fields are not consistent, that a follower nodesending the inconsistent uniqueness field is an erroneous node; anddetermines that a follower node not returning a result is a faulty node.

In an embodiment, when the leader node is a leader node newly generatedwithin a new consensus cycle, and when the follower node receives themessage sent by the leader node, the result sent by the follower node tothe client further includes a sequence number of the received message inaddition to the uniqueness field and the digital signature, so that theclient can compare the sequence number carried in the received resultwith a sequence number of the sent message. When a quantity of followernodes sending inconsistent sequence numbers exceeds a quantitythreshold, it indicates that the newly generated leader node sends aforged message to the follower nodes. Therefore, it is determined thatthe leader node is a malicious node.

It may be learned from the foregoing steps that in the first consensusmode:

(1) Communication reliability is ensured by using the digital signature:

Both parties in any communication use digital signatures. That is, asender adds a digital signature of a message when sending the message,for example, encrypting a digest of the message by using a private keyof an asymmetrical encryption algorithm of the sender, to form a digitalsignature of the sender. A receiver verifies the digital signature toensure reliability of the message, that is, decrypts the signature ofthe message by using a public key of the asymmetrical encryptionalgorithm (where it is ensured that the receiver and the sender use thesame asymmetrical encryption algorithm, and therefore the receiverpre-learns of the public key), and compares a digest obtained throughdecryption with the digest extracted from the message. If the digestsare consistent, it indicates that the digital signature is successfullyverified, and the message sent by the sender is reliable.

(2) The follower node directly returns the result to the client whenreceiving the message sent by the leader node, and adds information suchas the uniqueness field, the sequence number of the message, and thedigital signature to the result, so that the client can directlydetermine consensus reaching of the follower nodes according to theresult returned by the follower node, thereby easily detecting theabnormal node.

When the abnormal node is detected in the first consensus mode, becausethe first consensus mode is applicable to ensure consensus efficiency ofthe node but has a limitation on abnormal fault-tolerant performance ofthe node, the embodiments of the present disclosure provide a solutionof enabling a distributed system to switch to a second consensus modewith better fault-tolerant performance when there is an abnormal node inthe distributed system.

FIG. 6 is an optional schematic flowchart of switching between a firstconsensus mode and a second consensus mode by a distributed systemaccording to an embodiment of the present disclosure. Descriptions areprovided with reference to step 109 to step 112.

Step 109: A client triggers, when determining that there is an abnormalnode in the distributed system, nodes in the distributed system toswitch to the second consensus mode.

When a leader node is a malicious node, or there is a faulty node infollower nodes, or there is an abnormal node in follower nodes, theclient broadcasts, to the nodes in the distributed system, anotification of switching to the second consensus mode.

Step 110: A node in the distributed system sends a hash value and adigital signature of a message persistently stored by the correspondingnode to other nodes at a preparation stage of switching to the secondconsensus mode.

Using a node 200 as an example, the node 200 sends a hash value and adigital signature of a message persistently stored by the node 200 tonodes in the distributed system other than the node 200 at thepreparation stage of switching to the second consensus mode.

Step 111: A receiving node of a message receives hash values and digitalsignatures that are sent by all other nodes (that is, all nodes otherthan the receiving node) in the distributed system; compares, aftersuccessfully verifying digital signatures of the hash values, the hashvalues with a hash value of the message persistently stored by thereceiving node; and sends a consistency confirmation to the client ifthe hash values are all consistent.

For example, a node 1 receiving a notification in the distributed systemsends (for example, broadcasts), to nodes 2-N (where N is a quantity ofnodes in the distributed system) at the preparation stage of switchingto the second consensus mode, a hash value and a digital signature of amessage persistently stored in the node. In addition, the node 1receives hash values sent by the nodes 2-N. The hash values carrydigital signatures of corresponding nodes. After successfully verifyingthe digital signatures, the node 1 compares the hash values sent by thenodes 2-N with the hash value of the message persistently stored by thenode 1, and sends a consistency confirmation to the client if all thehash values are consistent.

For the nodes 2-N, processing after receiving hash values is similar tothat of the node 1, and details are not described herein again.

Step 112: The client detects whether consistency confirmations of allthe nodes are received; and if yes, instructs the nodes in thedistributed system to continue to switch to the first consensus mode; orif no, instructs the nodes in the distributed system to continueswitching to the second consensus mode.

If the client receives the consistency confirmations sent by all thenodes in the distributed system, it indicates that detection of theabnormal node is caused by network fluctuation or discarding of aresponse message, and there is no abnormal node in the distributedsystem. Therefore, the nodes re-switch to the first consensus mode, toensure consensus reaching efficiency of the nodes.

If the client does not receive, within a pre-determined time, theconsistency confirmations sent by all the nodes in the distributedsystem, it indicates that the abnormal node exists in the distributedsystem, and the client instructs the nodes in the distributed system tocontinue switching to the second consensus mode.

FIG. 7 is an optional schematic flowchart of switching between a firstconsensus mode and a second consensus mode by a distributed systemaccording to an embodiment of the present disclosure. The followingsteps are included:

Step 113: A client triggers, when determining that there is an abnormalnode in the distributed system, nodes in the distributed system toswitch to the second consensus mode.

When a leader node is a malicious node, or there is a faulty node infollower nodes, or there is an abnormal node in follower nodes, theclient broadcasts, to the nodes in the distributed system, anotification of switching to the second consensus mode.

Step 114: A node in the distributed system sends a hash value and adigital signature of a message persistently stored by the correspondingnode to other nodes at a preparation stage of switching to the secondconsensus mode.

Step 115: A receiving node of the message receives a hash value and adigital signature that are sent by another node in the distributedsystem; compares, after successfully verifying a digital signature ofthe hash value, the hash value with a hash value of the messagepersistently stored by the receiving node; and sends a data confirmationto a sending node of the message if the hash values are consistent.

For example, a node 1 receiving a notification in the distributed systemsends (for example, broadcasts), to nodes 2-N (where N is a quantity ofnodes in the distributed system) at the preparation stage of switchingto the second consensus mode, a hash value and a digital signature of amessage persistently stored in the node. In addition, the node 1receives hash values sent by the nodes 2-N. The hash values carrydigital signatures of corresponding nodes. After successfully verifyingthe digital signatures, the node 1 compares the hash values sent by thenodes 2-N with the hash value of the message persistently stored by thenode 1, and sends a data confirmation to each of the node 2 to the nodeN if all the hash values are consistent.

For the nodes 2-N, processing after receiving hash values is similar tothat of the node 1, and details are not described herein again.

Step 116: The client triggers, according to the data confirmation sentby each node, the nodes in the distributed system to return to the firstconsensus mode or continue switching to the second consensus mode.

For each node in the distributed system, the node broadcasts the hashvalue of the message persistently stored by the node and the digitalsignature of the sending node to other nodes. For the receiving node ofthe hash value, after verifying the digital signature of the receivedhash value, the receiving node compares the received hash value with ahash value of a message stored by the receiving node, and sends a dataconfirmation to a sending node of the corresponding hash value when thehash values are consistent. The data confirmation indicates thatmessages stored by the two nodes are consistent.

Two cases are involved herein:

Case 1: For a receiving node of a data confirmation, if receiving,within the pre-determined time, data confirmations sent by all othernodes (nodes other than the receiving node), the receiving node may senda data confirmation to the client. The client learns, according to thedata confirmation, that messages stored by the nodes are consistent, andit is unnecessary to continue switching to the second consensus mode.Therefore, the client may send, to each node in the distributed system,a notification of returning to the first consensus mode, and a processof switching to the second consensus mode ends.

For example, the node 1 sends a hash value to the node 2 to the node N,and the hash value carries a digital signature of the node 1. After thenode 2 to the node N−1 successfully verifies the digital signature ofthe node 1, using the node 2 as an example, the node 2 compares a hashvalue (where for a node in a block chain system, the hash value may be ahash value of a latest block in a block chain) of a message persistentlystored by the node 2 with the hash value sent by the node 1, and sends adata confirmation to the node 1 if the hash values are consistent.Processing performed by the node 3 to the node N−1 is similar to thatperformed by the node 2.

Assuming that the node 1 receives data confirmations of the node 2 tothe node N−1 but does not receive a data confirmation of the node N, theclient does not receive a data confirmation of the node 1 within thepre-determined time. Therefore, the client considers that data of thenode 1 is not consistent with that of all other nodes, and instructs thenode 1 to the node N to continue the operation of switching to thesecond consensus mode.

Case 2: When no node receives a data confirmation of another node withinthe pre-determined time, or when the client does not receive a dataconfirmation of another node because nodes reaching a consensus do notreceive, within the pre-determined time, a data confirmation of a nodenot reaching the consensus, the client instructs the nodes in thedistributed system to continue switching to the second consensus mode.

For example, the node 1 sends a hash value to the node 2 to the node N,and the hash value carries a digital signature of the node 1. After thenode 2 to the node N−1 successfully verifies the digital signature ofthe node 1, using the node 2 as an example, the node 2 compares a hashvalue (where for a node in a block chain system, the hash value may be ahash value of a latest block in a block chain) of a message persistentlystored by the node 2 with the hash value sent by the node 1, and sends adata confirmation to the node 1 if the hash values are consistent.Processing performed by the node 3 to the node N−1 is similar to thatperformed by the node 2.

Assuming that the node 1 receives data confirmations of the node 2 tothe node N−1 but does not receive a data confirmation of the node Nwithin the pre-determined time, the node 1 sends, to the client, anotification that the node 1 does not receive data confirmations of allother nodes within the pre-determined time, and the client instructs thenode 1 to the node N to continue the operation of switching to thesecond consensus mode.

For another example, the node 1 sends a hash value to the node 2 to thenode N, and the hash value carries a digital signature of the node 1.After the node 2 to the node N−1 successfully verifies the digitalsignature of the node 1, using the node 2 as an example, the node 2compares a hash value (where for a node in a block chain system, thehash value may be a hash value of a latest block in a block chain) of amessage persistently stored by the node 2 with the hash value sent bythe node 1, and sends a data confirmation to the node 1 if the hashvalues are consistent. Processing performed by the node 3 to the nodeN−1 is similar to that performed by the node 2.

Assuming that the node 1 receives data confirmations of the node 2 tothe node N−1 but does not receive a data confirmation of the node Nwithin the pre-determined time, the node 1 sends, to the client, anotification that the node 1 does not receive data confirmations of allother nodes (that is, nodes in the distributed system other than thenode 1), and the client instructs the node 1 to the node N to continuethe operation of switching to the second consensus mode.

A manner in which the nodes in the distributed system switch to thesecond consensus mode and then switch from the second consensus modeback to the first consensus mode continues to be described. For theswitching from the second consensus mode back to the first consensusmode, there are the following several manners:

Manner 1: The leader node triggers, when a counted quantity of timesthat a consensus is reached exceeds a consensus quantity-of-timesthreshold of the leader node, the follower nodes to switch back to thefirst consensus mode. The leader node and the follower nodes remain inthe node states (that is, the leader node state or the follower nodestate remains unchanged) in the second consensus mode when switching tothe first consensus mode.

When the distributed system is in the second consensus mode, for theleader node (where it may be understood that the leader node herein isspecific to a consensus cycle) in the distributed system, if the leadernode determines, through counting in the second consensus mode, that thequantity of times that a consensus is reached with the follower nodes onthe received message exceeds the consensus quantity-of-times threshold(for example, M times, where M is set according to consensus precisionof the nodes in the distributed system, generally, a higher precisionrequirement indicates a larger pre-determined quantity of times, andthere is a positively correlated relationship between the precisionrequirement and the pre-determined quantity of times) of the leadernode, it indicates that the leader node and the follower nodes havereached relatively desirable consensuses on continuous messages from theclient. To further improve the consensus reaching efficiency of thenodes in the distributed system, a notification of switching to thefirst consensus mode may be sent to the follower nodes.

For the follower node in the distributed system, after receiving thenotification of switching to the first consensus mode that is sent bythe leader node, the follower node sends a switch acknowledgement to theleader node (for acknowledging that the leader node can continueremaining in the leader node state when switching to the first consensusmode). The leader node and the follower node remain in the current nodestates and switch to the first consensus mode. In this way, a maliciousnode can be prevented from being the leader node in the first consensusmode, thereby ensuring the consensus efficiency.

It may be understood that the foregoing consensus node quantitythreshold may be a quantity of all follower nodes in the distributedsystem or a minimum value of a quantity of follower nodes used reach theconsensus in the distributed system in the first consensus mode (thatis, a minimum value of a consensus node quantity used by fault-tolerantperformance of the first consensus mode, where after the threshold isless than the minimum value, reliability of a reached consensus in thefirst consensus mode cannot be ensured).

Similarly, the foregoing consensus node proportion threshold maycorrespond to the quantity, that is, 100%, of all follower nodes in thedistributed system or the minimum value, for example, 51%, of thequantity of follower nodes used to reach the consensus in thedistributed system in the first consensus mode (that is, the minimumvalue of a consensus node quantity used by the fault-tolerantperformance of the first consensus mode, where after the threshold isless than the minimum value, the reliability of the reached consensus inthe first consensus mode cannot be ensured).

For example, the distributed system is in a second consensus mechanism,assuming that the node 1 is the leader node and the node 2 to the node Nare follower nodes, and each node counts consensuses reached on messagesfrom the client, for the node 1, if the node 1 reaches consensuses withthe node 2 to the node N on M (the consensus quantity-of-times thresholdof the leader node) latest messages from the client, it indicates thatthe nodes have reached a relatively good consensus with each other. Thenode 1 broadcasts, to the node 2 to the node N, the notification ofswitching to the first consensus mode, and the node 2 to the node N senda switch acknowledgement to the node 1 to acknowledge that the node 1 isstill the leader node in the first consensus mode and the node 2 to thenode N continue serving as the follower nodes. Even though there is amalicious node in the node 2 to the node N, a message from the clientcannot be forged, thereby ensuring the consensus reaching efficiency ofthe nodes.

Manner 2: The leader node determines, through counting, that a quantityof times that a consensus is reached exceeds a consensusquantity-of-times threshold of the leader node, and triggers thefollower nodes to switch back to the first consensus mode. Whendetermining, through counting, that a consensus reachingquantity-of-times threshold exceeds a consensus quantity-of-timesthreshold of the follower node, the follower node determines to switchback to the first consensus mode. The leader node and the follower nodesremain in the node states in the second consensus mode (that is, theleader node state or the follower node state remains unchanged) whenswitching to the first consensus mode.

When the distributed system is in the second consensus mode, the leadernode counts a quantity of times that a consensus is reached with othernodes (including the leader node and other follower nodes) on messagesfrom the client in the second consensus mode; and if the quantity oftimes that a consensus is reached exceeds a consensus quantity-of-timesthreshold of the follower node (which may be less than or equal to theconsensus quantity-of-times threshold of the leader node, and forexample, may be M/2), sends, to the leader node, a notification ofagreeing that the leader node continues serving as the leader node inthe first consensus mode and the follower nodes in the second consensusmode continue serving as the follower nodes when switching to the firstconsensus mode, to complete a voting operation for switching to thefirst consensus mode and continue reaching a consensus on a message fromthe client in the first consensus mode. In this way, a malicious nodecan be prevented from becoming the leader node in the first consensusmode, thereby ensuring the consensus efficiency.

After the nodes in the distributed system switch to the first consensusmode, if no abnormal node is detected in the first consensus mode, thenodes continue remaining in the first consensus mode, and the nodesre-switch to the second consensus mode if a relatively desirableconsensus still cannot be reached (where for example, a malicious node,an abnormal node, or an erroneous node can still be detected) after thenodes return to the first consensus mode.

A pre-determined quantity/proportion herein may be understood accordingto the foregoing descriptions, and details are not described hereinagain.

For example, the leader node in the distributed system may synchronouslystart timing based on a timer after switching to the second consensusmode; and after a timing time reaches a timing time threshold (forexample, 10 minutes), triggers the follower nodes in the distributedsystem to synchronously switch back to the first consensus mode. Avoting operation is performed in the first consensus mode to determine anew leader node and new follower nodes. If an abnormal node is stilldetected after the switching to the first consensus mode, the nodesswitch back to the second consensus mode again (where a manner ofswitching to the first consensus mode may be understood according to theforegoing descriptions). Therefore, the consensus reaching efficiency ofthe distributed system is maximally improved when a consensus is reachedin the second consensus mode to ensure the fault-tolerant performance ofthe distributed system.

A pre-determined quantity/proportion herein may be understood accordingto the foregoing descriptions, and details are not described hereinagain.

For example, the distributed system is in a second consensus mechanism.Assuming that the node 1 is the leader node and the node 2 to the node Nare follower nodes, and each node counts consensuses reached on messagesfrom the client. For the node 1, if the node 1 reaches consensuses withthe node 2 to the node N on M (the consensus quantity-of-times thresholdof the leader node) latest messages from the client, it indicates thatthe nodes have reached a relatively desirable consensus, and the node 1broadcasts, to the node 2 to the node N, a notification of switching tothe first consensus mode. For the node 2 to the node N, using the node 2as an example, the node 2 counts a quantity of times that a consensus isreached in the second consensus mode; and if the quantity of timesexceeds M/2, sends a switch acknowledgement to the node 1 (foracknowledging that the node 1 still serves as the leader node whenswitching to the first consensus mode and the node 2 serves as thefollower node). Processing of the node 3 to the node N is similar tothat of the node 2, and details are not described herein again.

When the node 1 receives a switch acknowledgement sent by each of thenode 2 to the node N, the nodes switch to the first consensus mode, andthe node 1 serves as the leader node and the node 2 to the node N serveas follower nodes in the first consensus mode. If the node 1 does notreceive a switch acknowledgement sent by each of the node 2 to the nodeN, the nodes continue remaining in the second consensus mode, and thenode 1 continues sending, to the node 2 to the node N at intervals ofM/2 quantity of times of consensuses, a notification of switching to thefirst consensus mode, until switch acknowledgements of the node 2 to thenode N are all received.

An example in which a block chain system (for example, a consortiumchain system maintained to open to an individual person or entity)reaches a consensus by using an improved RAFT (T-RAFT) algorithm in thefirst consensus mode and by using a PBFT algorithm in the secondconsensus mode is used below. It may be understood that a Paxos mayfurther be used in the first consensus mode, and a BFT algorithm, aBFT-RAFT algorithm, and the like may further be used in the secondconsensus mode. Any algorithm such as the T-RAFT algorithm that canachieve high consensus efficiency and can be used for detecting a nodefault or a Byzantine node may be used in the first consensus mode, andany algorithm that can implement Byzantine fault tolerance may be usedin the second consensus mode.

The RAFT algorithm provided in the related technology resolves a problemof data consistency of a plurality of nodes, but cannot implement theByzantine fault tolerance. However, the RAFT algorithm has relativelyhigh efficiency. The PBFT algorithm can implement the Byzantine faulttolerance. However, a message needs to be broadcast between nodes in thePBFT algorithm, resulting in relatively low implementation efficiency.

In a usage scenario in which a distributed network is applied to afederal chain (a block chain open to an individual person or entity),generally, there is no node fault or Byzantine node problem in a blockchain system in most of time, and a consensus between nodes can beefficiently reached by using the RAFT algorithm.

The RAFT algorithm provided in the related technology implementsconsistency of a plurality of nodes and has relatively high efficiency,but does not implement the Byzantine fault tolerance between nodes, andthe PBFT algorithm can ensure the consistency between a plurality ofnodes and implement the Byzantine fault tolerance between nodes.Therefore, in the embodiments of the present disclosure, the PBFTalgorithm can be automatically used to implement the consensus betweenthe nodes, provided that there is a node fault or a Byzantine problem.When all the nodes reach the consensus, that is, there is no Byzantinenode, the RAFT algorithm having relatively high consensus efficiency isthen automatically switched to, to implement the consensus between thenodes.

FIG. 8 is an optional schematic flowchart of reaching a consensus by ablock chain system by using a RAFT algorithm according to an embodimentof the present disclosure. After a client sends messages to a leadernode, the leader node sorts the received messages, and delivers themessages to follower nodes in the sorting order. Other follower nodesstore the messages to logs in an order organized by the leader node, andeach return a RPC result to the leader node. Then, after storing themessages in logs to a local disk, the leader node sends a Commit to eachfollower node. Each follower node stores the logs in the messages to alocal disk of the follower node, and consistency synchronization of themessage is completed. This results in relatively high efficiency butcannot resolve the problem of the Byzantine node.

FIG. 9 is an optional schematic flowchart of reaching a consensus by ablock chain system by using a PBFT algorithm according to an embodimentof the present disclosure. A message needs to be actually confirmedafter being broadcast twice. Due to dependency on broadcasting, aquantity of messages sent in a consensus reaching process is on thesquare class of a quantity of nodes. Therefore, the consensus reachingefficiency is relatively low, but the Byzantine fault tolerance betweenthe nodes can be implemented.

The RAFT algorithm can implement consistency and has high efficiency,but cannot implement the Byzantine fault tolerance, and therefore is notadopted in scenarios of many block chain systems. The PBFT algorithmthat has lower efficiency but can implement the Byzantine faulttolerance can be adopted. Features, to be specific, a network conditionis desirable, there is no Byzantine node in most cases, a consensusbetween a plurality of nodes is to be reached, in an applicationscenario of a federal chain is fully used in the embodiments of thepresent disclosure. In combination with the advantages of highefficiency of the RAFT algorithm and the fault tolerance of the PBFTalgorithm, an adaptive consensus algorithm that is efficient and thatcan implement the Byzantine fault tolerance is provided.

In a block chain system applied to a federal chain, a quantity of nodesparticipating in the consensus is limited, and there is no Byzantinenode in the participating nodes in most cases, provided that dataconsistency is ensured. In this case, the T-RAFT algorithm having higherefficiency is used. When there is an exception, for example, when thereis a Byzantine fault tolerance requirement between nodes or there is anode fault, the exception can be detected in time and the PBFT algorithmthat can support the Byzantine fault tolerance is automatically switchedto. When all nodes reach a consensus in the PBFT algorithm, the T-RAFTalgorithm having higher efficiency is then automatically switched to. Inthis way, in most cases, that is, when the network is desirable andthere is no Byzantine node, a requirement of the federal chain on aefficient consensus can be satisfied, and correction and fault tolerancecan be implemented in real time when there is an abnormal node.

To implement automatic switching between consensus algorithms, FIG. 10is a diagram of an operating status implementing an adaptive consensusalgorithm according to an embodiment of the present disclosure. Theblock chain system reaches a consensus in the T-RAFT algorithm bydefault. When it is detected by using the T-RAFT algorithm that aquantity of nodes whose data is inconsistent is less than a threshold (aquantity of all nodes or a pre-determined proportion of nodes, which isset according to fault tolerant performance of the T-RAFT algorithm),the block chain system enters a data (message) consistence confirmationstate: if it is confirmed that data of the nodes is consistent, theT-RAFT algorithm is still used; or if data of nodes is inconsistent, thePBFT algorithm is switched to, to implement the consensus between thenodes. When it is detected during operation of the PBFT algorithm, thatdata of all the nodes is consistent, the T-RAFT algorithm is thenswitched back to.

The T-RAFT algorithm is improvement of the RAFT algorithm, and canprevent a node from tampering, replaying, or forging a message and finda malicious node in time. FIG. 11 is a schematic diagram ofimplementation of a T-RAFT algorithm consensus according to anembodiment of the present disclosure. Compared with the RAFT algorithm,improvement is mainly related to the following several aspects:

1. A message sent by a client carries a digital signature of a messageentity for the message. In this way, the message can be prevented frombeing modified in a transmission process. In addition, the messagecarries a uniqueness field, to prevent the message from being replayedafter being intercepted.

2. A message transmitted between nodes carries a digital signature of asender, and a receiving node of the message verifies correctness of thedigital signature. In this way, a new node can be prevented from beingforged to participate in a voting operation or a node is prevented fromdisguised as a leader node to send a fake message to follower nodes.

3. After the client requests the leader node, and after all followernodes receive a message sent by the leader node in a process ofsynchronizing the message to the follower nodes by the leader node in aT-RAFT consensus mode, the follower nodes each return a result to theclient in addition to completing an original RAFT message procedure. Thereturned result carries a uniqueness field of the message and a digitalsignature of the follower node. In this way, the client can determinedata (message) consistency of the nodes by comparing whether resultsreturned by all the nodes are consistent. If the results received by theclient are not consistent, or the client does not receive results of allthe nodes within a pre-determined time, it is determined that there is aByzantine node or there is a faulty node, and a data consistencyconfirmation procedure is triggered.

The data consistency confirmation process happens at a middle stage ofconsensus algorithm switching, and a data recovery process is actually aconsensus process in which the minority is subordinate to the majority.The consensus process is performed through message broadcasting.Specifically, the node uses the T-RAFT algorithm by default. When thereis an erroneous node or a Byzantine node, the client can find out datainconsistency by comparing the results returned by the nodes, todetermine whether algorithm switching is used.

For example, if a consensus mode of the PBFT algorithm needs to beswitched to, the client broadcasts, to all the nodes, a notification ofswitching to the PBFT algorithm. When the node receives the consensusalgorithm switching notification and is at a preparation stage, the nodebroadcasts a data request acknowledgement message to all other nodes.The data request acknowledgement message carries a hash value of a blockof a latest consensus in a block chain of the node and a digitalsignature of the node.

A node receiving the data request acknowledgement message, which isreferred to as a receiving node herein, checks whether a hash value of ablock of a latest consensus in a block chain of the node is consistentwith the hash value carried in the data request acknowledgement message,and verifies correctness of the digital signature of the node. For thereceiving node, if the receiving node receives data requestacknowledgement messages of all other nodes, and these data requestacknowledgement messages include correct signatures and hash valuesconsistent with the hash value of the block of the latest consensus ofthe receiving node, the receiving node replies a data consistencyconfirmation to the client. The data consistency confirmation carries adigital signature of the receiving node.

If receiving data consistency confirmations of all the nodes, the clientconsiders that data of block chains maintained by the nodes isconsistent and a data consistency comparison failure before thealgorithm switching request is caused by network fluctuation ordiscarding of a response message, and therefore re-switches to theT-RAFT algorithm. For a specific procedure, refer to the followingmessage flowchart:

In an example, FIG. 12 is an optional schematic flowchart of switchingback to a T-RAFT algorithm at a preparation stage of switching to a PBFTalgorithm according to an embodiment of the present disclosure. In FIG.12, nodes 1, 2, 3, and 4 all receive broadcast messages of dataconsistency confirmations from other nodes, and confirm that hash valuesof blocks of latest consensuses of the nodes are consistent. The nodeseach return a data consistency confirmation to the client, and eachreturn to a state of the T-RAFT algorithm. Even though not receiving anotification of the client of re-switching to the T-RAFT algorithm, thenodes also enter a voting procedure of the T-RAFT algorithm after atimeout time expires.

If the client does not receive data consistency confirmations from allthe nodes within a timeout time, or consensus nodes (that is, hashvalues of latest blocks in the block chain system are consistent) do notreceive broadcast messages of data consistency confirmations from allother nodes, the client instructs all the nodes to switch to the PBFTalgorithm.

In addition, for any node, if not receiving broadcast messages of dataconsistency confirmations of all other nodes, the node automaticallyenters a PBFT algorithm state, and broadcasts a notification ofswitching to the PBFT algorithm.

After a node receives at least f+1 new algorithm broadcast messages(where f is a maximum value of a quantity of erroneous nodes allowed inthe block chain system according to the PBFT algorithm), the node startsinitiating a voting, also referred to as a view change, of a leader nodein a new algorithm (PBFT), and enters a consensus stage of the new PBFTalgorithm after completing the voting.

FIG. 13 is an optional schematic flowchart of switching from a T-RAFTalgorithm consensus to a PBFT algorithm consensus by a block chainsystem according to an embodiment of the present disclosure. In theschematic flowchart of a message, assuming that a node 4 is faulty, whennodes 1, 2, and 3 receive an algorithm switching notification of aclient to be at a preparation stage of switching to the PBFT algorithm,the nodes 1, 2, and 3 each broadcast a data request acknowledgementmessage. The message carries a hash value of a block of a latestconsensus of the node. The node 4 is faulty, and the nodes 1, 2, and 3do not receive, within a timeout time, a data consistency confirmation(a consistency response) broadcast by the node 4, and therefore do notsend a data consistency confirmation to the client. After the timeout,the nodes 1, 2, and 3 and the client all broadcast a notification ofswitching to the PBFT algorithm. A quantity of algorithm switchingnotifications that are received by the nodes 1, 2, and 3 is greater thanf+1. A node first receiving f+1 algorithm switching notifications firstinitiates a view change procedure. After the view change is completed, aPBFT algorithm consensus mode is entered.

In a PBFT consensus, once determining, through counting, that data isconsistent for consecutive M (configurable) times, the leader nodeconverts into a T-RAFT competitive node, and triggers a T-RAFT votingprocess. After receiving a voting request, other nodes agree thecompetitive node to convert into the leader node, provided that theother nodes also determine, through counting, that a quantity of timesof consecutive consensuses is greater than M/2 or greater than a fixedconfigured value T. When all follower nodes agree the competitive nodeto convert into the leader node, a consensus mode of the T-RAFTalgorithm is entered, and the quantity of times of consecutiveconsensuses of each node is zeroed out. The competitive node recovers toan original state immediately, that is, converts into the leader node inthe PBFT algorithm, provided that there is a follower node not agreeingthe competitive node to convert into the leader node, and continuesexecuting the PBFT algorithm. The quantity of times of consensusescounted by each node continues being accumulated, and a T-RAFT voting istriggered again until the quantity of times is M+T. If the T-RAFT votingfails, a T-RAFT voting is triggered next time at a time point M+2T. Therest can be deduced by analogy, and a T-RAFT voting is triggered at atime point M+x*T until the leader node is successfully voted. x is thequantity of times.

FIG. 14 is an optional schematic flowchart of switching from a PBFTalgorithm consensus mode to a T-RAFT algorithm consensus mode by a blockchain system according to an embodiment of the present disclosure. In aPBFT algorithm process, when the leader node, that is, a node 1,determines, through counting, that a quantity of times that data iscontinuously consistent (consensuses) exceeds M times, the node 1converts into a T-RAFT competitive node state, and then initiates avoting of the T-RAFT algorithm. After receiving a voting request(request vote) message, nodes 2, 3, and 4 determine whether a quantityof times that data is continuously consistent that is greater than M/2(or a fixed value T) is also counted, and if yes, return a switchacknowledgement for agreeing the competitive node to convert into theleader node.

The competitive node receives the switch acknowledgements of the nodes2, 3, and 4, converts into the leader node, and starts a T-RAFTalgorithm consensus stage. In a T-RAFT voting process, after receiving amessage of the client, the leader node (the node 1) in an original PBFTconsensus mode no longer sends a sequencing message, for example, apre-preparation message in the PBFT algorithm, and after the votingcompletes, attaches the message to an Append Entries RPC in the T-RAFTalgorithm to send the Append Entries RPC to follower nodes.

Descriptions are further provided with reference to a usage scenario inan actual application. FIG. 15 is an optional schematic diagram of ascenario in which a distributed system is applied to a federal chainsystem according to an embodiment of the present disclosure. The federalchain system is open to an individual person or entity and includes aplurality of nodes. Each node provide access for a third-party paymentinstitution and a bank service system (as a client), and receivestransaction records committed by the third-party payment institution andthe bank service system. After reaching a consensus on a committedtransaction record, the node stores the transaction record in a latestblock of a block chain, so that the third-party payment institution andthe subscribed bank perform account reconciliation according tocorresponding service turnover.

The node reaches the consensus on the transaction record in the T-RAFTconsensus mode by default, and switches to a PBFT consensus mode whenthere is an abnormal node to reach the consensus on the transactionrecord.

A third-party payment terminal of a user is bound to a credit cardaccount of the user in a bank. When the user trades with a merchantoffline or online, the third-party payment terminal may transfer moneyfrom the credit card account of the user to an account of the merchantthrough pre-obtained pre-authorization of the credit card account, toform a transaction record.

For this transaction, a service system of the third-party paymentinstitution commits a transaction record (for example, including apayee, a payer, and a payment amount, and carrying a digital signatureof the third-party payment client) to the accessed leader node in thedistributed system. After successfully verifying the digital signatureof the received transaction record, the leader node synchronizes thetransaction record to other follower nodes (where the transaction recordcarries a digital signature of the leader node). After successfullyverifying the digital signature of the transaction record, the followernode returns a result (carrying a digital signature of the follower nodeand a uniqueness field, and further carrying a sequence number of thetransaction record when the leader node is a newly voted leader node) tothe service system of the third-party payment institution, and notifiesthe leader node that synchronization is completed. After confirming thateach follower node completes the synchronization, the leader node storesthe transaction record in a latest block of a block chain and notifiesthe follower node. The follower node performs the same operation, topersistently store the transaction record.

For the foregoing consensus process for the transaction record, ifdetermining, according to the result returned by the follower node, thatthe leader node is a malicious node or the follower node is faulty, theclient triggers the federal chain system to switch to the PBFT consensusmode to reach the consensus on the transaction record, to ensure thatthe transaction record can be successfully stored in the block chain ofeach node; and may switch back to the T-RAFT consensus mode according toa consensus case, for example, that a relatively good formula (where theleader node and other nodes reach consensuses for consecutive M times)is obtained, of the federal chain system on a transaction recordsubsequently committed by the service system of the third-party paymentinstitution, to improve consensus efficiency.

In conclusion, the embodiments of the present disclosure have thefollowing beneficial effects:

(1) Reliability of communication between the client and the nodes andbetween nodes is ensured by using digital signatures, to avoid messageforging and ensure reliability of communication inside the distributedsystem.

(2) The follower node directly returns the result to the client whenreceiving the message sent by the leader node, and adds information suchas the uniqueness field, the sequence number of the message, and thedigital signature to the result, so that the client can directlydetermine consensus reaching of the follower nodes according to theresult returned by the follower node, thereby easily detecting theabnormal node.

(3) When an abnormal node is detected, the default first consensus modewith higher consensus efficiency can be switched to the second consensusmode with better fault-tolerant performance, to ensure that theconsensus of the distributed system can be successfully reached when anexception occurs.

(4) Once a good consensus (for example, determined based on a quantityof times of consensuses) is reached in the second consensus mode, thefirst consensus mode is switched to again. This adaptive consensus modeswitching implements optimal combination between the consensusefficiency and the fault-tolerant performance. The technical effect ofhigh consensus efficiency is achieved in most time when a runningnetwork status of the distributed network is desirable, and normalprocessing of a service function of the distributed system is ensuredwhen there is a faulty node or a Byzantine node.

A person skilled in the art may understand that all or some of the stepsin the foregoing method embodiments may be implemented by a programinstructing relevant hardware. The program may be stored in acomputer-readable storage medium. The program, when executed, performsthe steps in the foregoing method embodiments. The foregoing storagemedium includes a medium, such as a mobile storage communication statusprocessing apparatus, a random access memory (RAM), a read-only memory(ROM), a magnetic disk, or a compact disc, that can store program code.

Alternatively, when the integrated module in the present disclosure isimplemented in the form of a software function module and sold or usedas an independent product, the integrated module may be stored in acomputer readable storage medium. According to such an understanding,the technical solutions of the embodiments of the present disclosureessentially, or the part contributing to the related technology may beimplemented in a form of a software product. The computer softwareproduct is stored in a storage medium, and includes several instructionsfor instructing a computer communication status processing apparatus(which may be a personal computer, a server, a network communicationstatus processing apparatus, or the like) to perform all or some of thesteps of the methods described in the embodiments of the presentdisclosure. The foregoing storage medium includes various media, such asa mobile storage communication status processing apparatus, a RAM, aROM, a magnetic disc, and a compact disc, that can store program code.

The foregoing descriptions are merely specific implementations of thepresent disclosure, but are not intended to limit the protection scopeof the present disclosure. Any variation or replacement readily figuredout by a person skilled in the art within the technical scope disclosedin the present disclosure shall fall within the protection scope of thepresent disclosure. Therefore, the protection scope of the presentdisclosure shall be subject to the protection scope of the claims.

What is claimed is:
 1. A client device with a digital signature,comprising: processing circuitry configured to: send a message to bestored in nodes after the nodes reach a consensus on the message, themessage including the digital signature of the client device; obtain, bythe processing circuitry of the client device, results from a subset ofthe nodes that receive the message, the results having respectivedigital signatures of the subset of the nodes, the nodes including aleader node and follower nodes and being in a first consensus mode forreaching the consensus on the message; after verifying the digitalsignatures of the subset of the nodes, determine, by the processingcircuitry of the client device, based on the results, whether one ormore of the nodes has malfunctioned; and based on the one or more of thenodes being determined to be malfunctioned, trigger, by the processingcircuitry of the client device, the nodes to switch from the firstconsensus mode to a second consensus mode, the first consensus mode andthe second consensus mode corresponding to different consensusalgorithms; and determine, by the processing circuitry of the clientdevice, a leader node from the nodes for the second consensus mode afterthe nodes are switched to the second consensus mode.
 2. The clientdevice according to claim 1, wherein: the message from the client devicefurther includes first unique information; the subset is of the followernodes; each of the results includes second unique information; and theprocessing circuitry is further configured to: for each of the followernodes, determine whether the respective follower node is an erroneousnode based on a determination that the second unique information in theresult sent by the respective follower node is different from the firstunique information in the message from the client device; and determinethat the respective follower node is a faulty node when a result is notreceived from the respective follower node.
 3. The client deviceaccording to claim 2, wherein the message from the client deviceincludes a first sequence number; each of the results includes a secondsequence number; and the processing circuitry is further configured to:for each of the follower nodes, determine that the respective followernode sends an inconsistent sequence number when the second sequencenumber is different from the first sequence number; and determine thatthe leader node is a malicious node when a number of the follower nodessending the inconsistent sequence numbers exceeds a threshold.
 4. Theclient device according to claim 3, wherein the processing circuitry isfurther configured to: trigger the nodes to switch from the firstconsensus mode to the second consensus mode when the processingcircuitry determines at least one of: the leader node is the maliciousnode, at least N of the follower nodes are the faulty nodes, or at leastM of the follower nodes are the erroneous nodes, N and M being positiveintegers.
 5. A distributed system, comprising: the client deviceaccording to claim 4, and the nodes, wherein each of the nodes isconfigured to: after receiving the trigger from the processing circuitryto switch to the second consensus mode, send a hash value in a messagestored by the respective node and a digital signature of the respectivenode to other nodes in the distributed system; receive hash values inmessages from the other nodes; determine whether the hash value storedby the respective node is consistent with the hash values from the othernodes; and send a consistency confirmation to the client device when thehash value stored by the respective node is determined to be consistentwith the hash values from the other nodes.
 6. The distributed systemaccording to claim 5, wherein the processing circuitry of the clientdevice is further configured to: determine whether the consistencyconfirmation from each of the nodes is received; when the client devicedoes not receive the consistency confirmation from at least one of thenodes within a pre-determined time, notify the nodes to switch to thesecond consensus mode; and when the client device receives theconsistency confirmation from each of the nodes within thepre-determined time, notify the nodes to switch to the first consensusmode.
 7. A distributed system, comprising: the client device accordingto claim 4, and the nodes, wherein each of the nodes is configured to:after receiving the trigger to switch to the second consensus mode, senda hash value in a message stored by the respective node and a digitalsignature of the respective node to other nodes in the distributedsystem; receive another hash value in a message from one of the othernodes; determine whether the hash value stored by the node is consistentwith the other hash value from the one of the other nodes; send a dataconfirmation to the one of the other nodes when the hash value of therespective node is determined to be consistent with the other hashvalue, the data confirmation including the digital signature of therespective node and indicating that the message stored by the respectivenode is consistent with the message from the one of the other nodes; andwhen the respective node receives the data confirmation from each of theother nodes, send a data confirmation to the client device.
 8. Thedistributed system according to claim 7, wherein the processingcircuitry is further configured to: determine whether the message storedin the respective node is consistent with the messages stored in theother nodes based on the data confirmation from the respective node;when each of the data confirmations from the nodes to the client deviceis received within a pre-determined time, notify the nodes to switchback to the first consensus mode; and terminate switching to the secondconsensus mode; and when at least one of the data confirmations from thenodes to the client device is not received within the pre-determinedtime, notify the nodes to switch to the second consensus mode.
 9. Adistributed system, comprising: the client device according to claim 4;and the nodes, wherein the leader node is configured to: switch thenodes to the first consensus mode when a number of times that the nodesreach the consensus on the received message from the client device inthe second consensus mode exceeds a first consensus threshold of theleader node.
 10. The distributed system according to claim 9, whereinone of the follower nodes is configured to: count a number of times thatthe consensus is reached on the received message when receiving anotification to switch to the first consensus mode; and send a switchacknowledgement to the leader node when the counted number of timesexceeds a second consensus threshold of the one of the follower nodes.11. A message processing method, comprising: sending, by processingcircuitry of a client device with a digital signature, a message to bestored in nodes after the nodes reach a consensus on the message, themessage including the digital signature of the client device; obtaining,by the processing circuitry of the client device, results from a subsetof the nodes that receive the message, the results having respectivedigital signatures of the subset of the nodes, the nodes including aleader node and follower nodes and being in a first consensus mode forreaching the consensus on the message; after verifying the digitalsignatures of the subset of the nodes, determining, by the processingcircuitry of the client device, based on the results, whether one ormore of the nodes has malfunctioned; and based on the one or more of thenodes being determined to be malfunctioned, triggering, by theprocessing circuitry of the client device, the nodes to switch from thefirst consensus mode to a second consensus mode, the first consensusmode and the second consensus mode corresponding to different consensusalgorithms; and determining, by the processing circuitry of the clientdevice, a leader node from the nodes for the second consensus mode afterthe nodes are switched to the second consensus mode.
 12. The messageprocessing method according to claim 11, wherein the message from theclient device further includes first unique information; the subset isof the follower nodes; each of the results includes second uniqueinformation; and the message processing method further includes: foreach of the follower nodes, determining, by the processing circuitry,whether the respective follower node is an erroneous node based on adetermination that the second unique information in the result sent bythe respective follower node is different from the first uniqueinformation in the message from the client device; and determining, bythe processing circuitry, that the respective follower node is a faultynode when a result is not received from the respective follower node.13. The message processing method according to claim 12, wherein themessage from the client device includes a first sequence number; each ofthe results includes a second sequence number; and the messageprocessing method further includes: each of the follower node,determining, by the processing circuitry, that the respective followernode sends an inconsistent sequence number when the second sequencenumber is different from the first sequence number; and determining, bythe processing circuitry, that the leader node is a malicious node whena number of the follower nodes sending the inconsistent sequence numbersexceeds a threshold.
 14. The message processing method according toclaim 13, further comprising: triggering, by the processing circuitry,the nodes to switch from the first consensus mode to the secondconsensus mode when the processing circuitry determines at least one of:the leader node is the malicious node, at least N of the follower nodesare the faulty nodes, or at least M of the follower nodes are theerroneous nodes, N and M being positive integers.
 15. The messageprocessing method according to claim 14, further comprising: afterreceiving the trigger from the processing circuitry to switch to thesecond consensus mode, sending, by each of the nodes, a hash value in amessage stored by the respective node and a digital signature of therespective node to other odes; receiving, by the respective node, hashvalues in messages from the other nodes; determining, by the respectivenode, whether the hash value stored by the respective node is consistentwith the hash values from the other nodes; and sending, by therespective node to the client device, a consistency confirmation whenthe hash value stored by the respective node is determined to beconsistent with the hash values from the other nodes.
 16. The messageprocessing method according to claim 15, further comprising:determining, by the processing circuitry, whether the consistencyconfirmation from each of the nodes is received; when the client devicedoes not receive the consistency confirmation from at least one of thenodes within a pre-determined time, notifying the nodes to switch to thesecond consensus mode; and when the client device receives theconsistency confirmation from each of the nodes within thepre-determined time, notifying the nodes to switch to the firstconsensus mode.
 17. The message processing method according to claim 14,further comprising: after receiving the trigger to switch to the secondconsensus mode from the client device, sending, by each of the nodes, ahash value in a message stored by the node and a digital signature ofthe node to other nodes; receiving another hash value in a message fromone of the other nodes; determining whether the hash value stored by thenode is consistent with the other hash value from the one of the othernodes; sending a data confirmation to the one of the other nodes whenthe hash value of the respective node is determined to be consistentwith the other hash value, the data confirmation including the digitalsignature of the respective node and indicating that the message storedby the node being consistent with the message from the one of the othernodes; and when the respective node receives each data continuation fromeach of the other nodes, sending a data confirmation to the clientdevice.
 18. The message processing method according to claim 17, furthercomprising: determining whether the message stored in the respectivenode is consistent with the messages stored in the other nodes based onthe data confirmation from the respective node; when each of the dataconfirmations from the nodes to the client device is received within apre-determined time, notifying the nodes to switch back to the firstconsensus mode; and terminating switching to the second consensus mode;and when at least one of the data confirmations from the nodes to theclient device is not received within the pre-determined time, notifyingthe nodes to switch to the second consensus mode.
 19. The messageprocessing method according to claim 14, further comprising: switchingthe nodes to the first consensus mode when a number of times that thenodes reach the consensus on the received message from the client devicein the second consensus mode exceeds a first consensus threshold of theleader node.
 20. A non-transitory computer-readable storage mediumstoring a program executable by one or more processors of a clientdevice with a digital signature to perform: sending a message to bestored in nodes after the nodes reach a consensus on the message, themessage including the digital signature of the client device; obtainingresults from a subset of the nodes that receive the message, the resultshaving respective digital signatures of the subset of the nodes, thenodes including a leader node and follower nodes and being in a firstconsensus mode for reaching the consensus on the message; afterverifying the digital signatures of the subset of the nodes,determining, based on the results, whether one or more of the nodes hasmalfunctioned; and based on the one or more of the nodes beingdetermined to be malfunctioned, triggering the nodes to switch from thefirst consensus mode to a second consensus mode, the first consensusmode and the second consensus mode corresponding to different consensusalgorithms; and determining a leader node from the nodes for the secondconsensus mode after the nodes are switched to the second consensusmode.